The European Public Prosecutor’s Office (“EPPO”) is committed to ensuring that you have all the information you need in order to understand how your data is being processed, understand your rights, and how to exercise them. Below you can find all the details of the processing of personal data in the context of the exercise of data subject rights, and the relevant contact details for further information, assistance or redress.
a) Identity and contact details of the controller
The entity that determines how and why the personal data are processed in the context of the exercise of data subject rights and which is legally responsible for complying with data protection obligations under Regulation (EU) 2018/1725 is the EPPO. You may contact the EPPO by email to info (at) eppo.europa.eu or by mail marked for the attention of the Administrative Director, EPPO, 11 Avenue John F. Kennedy, 1855 Luxembourg.
b) Contact details of the Data Protection Officer
The Data Protection Officer (“DPO”) of the EPPO can be reached by email to DPO (at) eppo.europa.eu, or by mail marked for the attention of the DPO, EPPO, 11, Avenue John F. Kennedy, 1855 Luxembourg, for assistance and with regard to any issues in relation to the processing of your personal data and the exercise of your rights, as outlined below under h).
c) Purpose and legal basis for the processing of personal data
The processing of your personal data serves the purpose of performing the required checks as foreseen by law, as well as the administration required for the exercise of data subject rights. The legal basis for processing of personal data in the context of this processing activity is Article 5(1)(b) of Regulation (EU) 2018/1725 in relation to the EPPO’s obligation to comply with its legal obligations regarding the exercising of data subject rights by individuals.
d) Categories of personal data concerned
The EPPO collects the full name and date of birth along with, if applicable, the data as contained on a copy of the passport or other identity document of the individual wishing to exercise their rights, as well as of any person acting on their behalf, if applicable. Depending on the chosen means of communication, we may also process the email address, telephone number and / or postal address. Additionally, in case the request is made on behalf of the actual applicant, proof of their authorisation (power of attorney or the like) is also collected and processed.
e) Recipients or categories of recipients of the personal data
The DPO and the staff provided by the EPPO for the exercise of the duties of the DPO will have access to all content of the file created for processing the request (containing all related correspondence, documents and personal data). In case of operational personal data creating one or more hits, the full name and date of birth will also be shared with the European Delegated Prosecutor(s) in charge of the prosecution(s) or investigation(s), as well as, potentially, the respectively competent European Prosecutor(s) and European Chief Prosecutor, in order to assess the applicability of any restrictions to the exercise of the request, in line with the EPPO’s applicable rules and procedures.
In case of administrative personal data creating one or more hits, the full name and date of birth will also be shared with the Head of Unit / Sector internally allocated responsibility for the processing operation under which a hit was found, the Administrative Director, as well as the EPPO staff assisting them for this purpose. Lastly, any other persons, internal or external, in the context of audits, internal investigations, or responding to data protection or security related incidents may also have access to all or some of the personal data, to the extent determined by the circumstances.
f) Transfers to third countries and / or international organisations
N/a
g) Period for which the personal data will be stored
The personal data will be processed until the request has been fully dealt with and concluded. Thereafter, it will be stored for a period of 3 years for audit and compliance purposes, after which all personal data will be deleted.
h) Right to request access, rectification, erasure, restriction, objection and data portability
You have the right at any time to request access to your personal data and to have them rectified in case they are inaccurate or incomplete, to object to or request restriction of processing of your personal data, to erase your personal data and to data portability. To exercise these rights, request assistance or if you have a question thereto, or to file a complaint, you may contact the DPO of the EPPO by using the contact details above.
i) Right to withdraw consent
N/a
j) Complaints to the European Data Protection Supervisor
You have the right to address yourself to the European Data Protection Supervisor (“EDPS”) to lodge a complaint. The EDPS can be contacted by email to EDPS (at) edps.europa.eu, or by post to EDPS, Rue Wiertz 60, B-1047 Brussels.
k) Source from which the personal data originate
The personal data for this purpose have been exclusively collected directly from the applicant or their authorised representative.
l) Mandatory nature of provision of personal data
The provision of the personal data as indicated above is mandatory in order for the ability of the EPPO to act upon your request.
m) Automated decision-making
The processing of your personal data by the EPPO in the context of this processing activity does not result in any decision, which produces legal effects concerning you or similarly significantly affects you.
n) Record of processing activity
The related record of processing activity kept by the EPPO with record no. APD-121022-AD is available from the EPPO’s DPO.
Last Update: 12/10/2022